home

installconverter_tsv45gi6n.exe

ClientConnect LTD

The file belongs to the ClientConnect (Conduit/Perion) platform, a utility that bundles and monetizes search toolbars and browser add-ons. The application installconverter_tsv45gi6n.exe by ClientConnect has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the Perion Download Manager installer. This file is typically installed with the program BitLord 2.3 by House of Life. The file has been seen being downloaded from dde.integration.storage.conduit-services.com and multiple other hosts.
Publisher:
ClientConnect LTD  (signed and verified)

MD5:
f2315e8d71fbb8fd6688934242cd2b3d

SHA-1:
a60a9dc80fb718d43d734c44149ae7c37ca96c26

SHA-256:
5f44fe29f276e0f5f24f041d037949be7b2d58eb650dee04acc75c0f28892b38

Scanner detections:
6 / 68

Status:
Adware

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/26/2024 12:03:13 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Conduit.27
9.0.1.060

Emsisoft Anti-Malware
Gen:Trojan.Heur.VP2.Iu0baKOeL0bi
8.14.03.01.01

ESET NOD32
Win32/Wajam (variant)
8.9485

Malwarebytes
PUP.Optional.Conduit
v2014.03.01.01

Reason Heuristics
PUP.ClientConnect.AA
14.3.16.13

Trend Micro House Call
TROJ_GEN.F47V0228
7.2.60

File size:
681.6 KB (697,920 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Perion Download Manager (using Nullsoft Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installconverter_tsv45gi6n.exe

Digital Signature
Signed by:
ClientConnect LTD

Authority:
VeriSign, Inc.

Valid from:
2/4/2014 12:00:00 AM

Valid to:
2/5/2016 11:59:59 PM

Subject:
CN=ClientConnect LTD, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=DM1, O=ClientConnect LTD, L=Ness Ziona, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4B1AA4E0160AB83115939D2007F97611

File PE Metadata
Compilation timestamp:
2/24/2012 7:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:zERGSnhGehZ0Cmlmo0cwZCKzQ27hRb6JYnNkUIf/2oIfRYmLRWFGaRYqZh3Px:zm/nhGBxCFQ8b6CVIfejnRWqqZxPx

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Entropy:
7.9544

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file installconverter_tsv45gi6n.exe has been discovered within the following program.

BitLord 2.3  by House of Life
Publisher's description - “Find anything without visiting bad websites. Read what others think about a download and leave your praise, anger, meh or love in our comments system. Help others and help yourself by letting people know which torrents are good.”
www.bitlord.com
About 2% of users remove it
 
Powered by Should I Remove It?

The file installconverter_tsv45gi6n.exe has been seen being distributed by the following 3 URLs.

http://dde.integration.storage.conduit-services.com/7/764/ct7643207/89e65d5f076e4944910e3feedd098661/Downloads/Prod/DDE1.3.8.8.140217.01/.../InstallConverter.exe

http://89e65d5f076e4944910e3feedd098661.integration.download.conduit-services.com/Default.ashx?EnvironmentID=1&sessiontracking=true

http://installldownload.com/.../downloadsp.php

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-54-225-182-66.compute-1.amazonaws.com  (54.225.182.66:80)

TCP (HTTP):
Connects to a104-90-20-126.deploy.static.akamaitechnologies.com  (104.90.20.126:80)

Remove installconverter_tsv45gi6n.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.